security-and-hardening
Pass
Audited by Gen Agent Trust Hub on Jul 8, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides a structured process for security auditing, including checklists for broken access control, cryptographic failures, and injection attacks. These instructions align with industry best practices.
- [COMMAND_EXECUTION]: The skill recommends the use of standard development tools such as
npm auditandpip auditto identify vulnerable components in project dependencies. - [PROMPT_INJECTION]: The skill is designed to process untrusted code as part of its auditing function, which creates an indirect prompt injection surface. The ingestion points include the source code of 'every changed file' (SKILL.md). While explicit boundary markers and input sanitization are not defined in the skill text, the instructions specifically direct the agent to 'verify' and 'assume breach', which serves as a functional mitigation for this surface.
- [SAFE]: References to the
gitleaksGitHub action and related license configurations are standard practices for implementing secret scanning in CI/CD pipelines.
Audit Metadata